Sample · Part I · Sections 1 – 2 · Deciding and setting up

Before you begin

Most companies set up an account first and think afterwards about who may use it. That is the wrong order, and you only notice when the first file is in the wrong place or the first colleague has an access that nobody knows the purpose of.

Four decisions belong before that. None of them needs the interface; that is why this section has no picture. Anyone who is already clicking here is not deciding.

1.1 Who may use it?

Not "everyone" and not "just me, let's see". Write down two or three names, or a function: the office manager and me. The reason is practical: every further access is a further place where something can get in that does not belong there — and a further person you have to see off when they leave.

Whoever starts small can expand. Whoever starts wide has to gather things back in.

With this provider there is a particular point you should know now: a business account starts at two paid seats, even if only one is occupied. A one-person business therefore decides here whether it takes the second seat as a reserve — for the deputy, the tax adviser, the temporary help — or whether a personal account on a company address is enough for now. Section 2 shows what distinguishes the two routes.

What Volume 2 says about this: the decision about the group of users lies with management, and it is the first of four that come before any policy (Volume 2, Section 4).

1.2 For what?

Two or three concrete tasks, not a wish list. Preparing quotation texts. Summarising long e-mails. Turning minutes into tasks.

That is not bureaucracy but the yardstick by which you will measure in three months whether it was worth it. Without it, only a feeling remains. And it is the basis for Section 4: for a recurring task, a project with stored instructions pays off; for a wish list, nothing does.

1.3 With what data?

This is where it gets serious, and this is where this guide stops being an operating manual. What may go into an AI tool and what may not is not decided at the interface but by your company and by what applies to you.

What has to be considered is in Volume 1, Section 12.3 — where the outflow of data through prompts is described as a risk — and in Section 2.4, where the contractual checkpoints are: data processing agreement, place of processing, training with business data, liability for third-party rights. Section 2 of this guide says which of the provider's documents belongs to which checkpoint and where it is; whether it is sufficient for your company, it does not say.

For a start, a single line that you draw yourself is enough: What you would not send to an external service provider without a contract does not go in here either. Section 6 turns that into a list.

1.4 Who tidies up?

One person, by name. Once a month they check who has access, what is in the projects, which connections to other services are active and whether what was decided three months ago still holds. In a one-person business that is you — so put an appointment in your calendar, otherwise it will not happen.

Section 8 says what this person looks at.